Description

This article provides information on how to reject traffic for multicast groups, without using a security policy.

Symptoms

Block multicast traffic for the 225.5.5.5 group.

Solution


The multicast scope-policy will be used to reject traffic for the 225.5.5.5 multicast group. The policy is as follows: 

root@PRJFW13A# show policy-options 
policy-statement test {
    term t1 {
        from {
            route-filter 225.5.5.5/32 exact;
        }
        then reject;
    }
    term t2 {
        then accept;
    }

}

The above policy will now be applied under the multicast scope-policy, as shown below: 

[edit]
root@PRJFW13A# show routing-options                                    
multicast {
    scope-policy test; 
}

Verification :

Now, check via the pim join command, before and after applying the above policy: 

[edit]
root@240-2# run show pim join extensive | no-more 
Instance: PIM.master Family: INET
R = Rendezvous Point Tree, S = Sparse, W = Wildcard

Group: 225.5.5.5
    Source: *
    RP: 192.168.69.1
    Flags: sparse,rptree,wildcard
    Upstream interface: Local                 
    Upstream neighbor: Local
    Upstream state: Local RP
    Uptime: 00:07:19 
    Downstream neighbors:
        Interface: ge-0/0/2.0             
            192.168.69.1 State: Join Flags: SRW  Timeout: Infinity
            Uptime: 00:07:19 Time since last Join: 00:07:19

Group: 225.5.5.5
    Source: 192.168.70.2
    Flags: sparse,spt
    Upstream interface: ge-0/0/3.0            
    Upstream neighbor: Direct
    Upstream state: None, Local Source, Local RP
    Keepalive timeout: 350
    Uptime: 00:07:40 
    Downstream neighbors:
        Interface: ge-0/0/2.0             
            192.168.69.1 State: Join Flags: S   Timeout: Infinity
            Uptime: 00:07:19 Time since last Join: 00:07:19

Group: 239.255.255.250
    Source: *
    RP: 192.168.69.1
    Flags: sparse,rptree,wildcard
    Upstream interface: Local                 
    Upstream neighbor: Local
    Upstream state: Local RP
    Uptime: 00:07:55 
    Downstream neighbors:
        Interface: ge-0/0/3.0             
            192.168.70.1 State: Join Flags: SRW  Timeout: Infinity
            Uptime: 00:07:55 Time since last Join: 00:07:55

Instance: PIM.master Family: INET6
R = Rendezvous Point Tree, S = Sparse, W = Wildcard


[edit]
root@240-2# commit 
commit complete
After applying the policy: 
[edit]
root@240-2# run show pim join extensive | no-more                           
Instance: PIM.master Family: INET
R = Rendezvous Point Tree, S = Sparse, W = Wildcard

Group: 225.5.5.5
    Source: *
    RP: 192.168.69.1
    Flags: sparse,rptree,wildcard
    Upstream interface: Local                 
    Upstream neighbor: Local
    Upstream state: Local RP
    Uptime: 00:09:28 
    Downstream neighbors:
        Interface: ge-0/0/2.0 (administratively scoped)
            192.168.69.1 State: Join Flags: SRW  Timeout: Infinity
            Uptime: 00:09:28 Time since last Join: 00:01:04

Group: 239.255.255.250
    Source: *
    RP: 192.168.69.1
    Flags: sparse,rptree,wildcard
    Upstream interface: Local                 
    Upstream neighbor: Local
    Upstream state: Local RP
    Uptime: 00:10:04 
    Downstream neighbors:
        Interface: ge-0/0/3.0             
            192.168.70.1 State: Join Flags: SRW  Timeout: Infinity
            Uptime: 00:10:04 Time since last Join: 00:01:04

Instance: PIM.master Family: INET6
R = Rendezvous Point Tree, S = Sparse, W = Wildcard